[ insider_reports_insider ]
Gmail Rings In New Year With XSS
David Utter
Staff Writer
2007-01-02
 Insider Reports RSS Feed
Users of Google's Gmail service should avoid staying logged in to it until a cross-site scripting issue can be completely fixed.
 | | Gmail Rings In New Year With XSS |  |
Gmail staggered through the end of 2006 like a punch-drunk boxer after the 15th round. The service suffered a couple of serious problems in recent weeks, and they don't encourage confidence in Google's various initiatives that require trusting them with all of your information.
In mid-December, a situation arose where a few dozen Gmail accounts were cleaned out of all their messages and contacts. News of that, and Google's response, only came to light when TechCrunch spotted it on a Gmail support forum.
A Google representative responded to TechCrunch's Michael Arrington to confirm the losses had taken place. She did not elaborate on a cause, though suggestions of either an exploit of a flaw in Firefox 2.0 or the possibility that someone maliciously used passwords for logins on a website to get in to Gmail accounts using the same password have been raised.
Then as the New Year arrived, Garett Rogers described how one of his 'Googling Google' readers was able to easily create a cross-site scripting crack to display a Gmail account's contacts via the JSON API Rogers had described in a previous post.
Rogers later wrote Google appeared to have the problem partially corrected. Since the XSS issue has not been completely fixed, he suggested people should avoid staying logged in to Gmail until it is.
If the Gmail deletion issue is due to people using the same password on Gmail and other sites, with the result being a pilfered password opening a Gmail account too, it places a responsibility on people not to use the same password on multiple websites.
That's going to be an issue for the many people who will not want to have a massive list of passwords to memorize or otherwise keep in a list. Users shouldn't have to worry about this in the first place; database-driven websites should be hashing passwords in their indexes rather than keeping them in plaintext anyway.
---
Tag: Gmail
Add to  Del.icio.us |  Digg |  Reddit |  Furl
Get all the updates - 
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
RSS
Archive
Contact Us
Advertise
